You got a Cash App verification code you didn't request

A Cash App code arriving when you aren't signing in is worth more attention than the same text from a shopping app. Cash App holds a balance, a linked bank account, and a debit card, and money that leaves it is hard to claw back.

What the code means here

Cash App signs you in with a code sent to your phone or email rather than a password you type. That changes what an unrequested code tells you.

On most services, a code means someone had your password. On Cash App, it means someone entered your phone number or email address into the sign-in screen and asked the system to text you. They don't need a password. They need the code, which is why the next thing that usually happens is someone contacting you to ask for it.

That's the whole attack. Everything below assumes they'll try.

What to do now

1. Don't give the code to anyone, on any pretext

Cash App support will never ask for a sign-in code, your PIN, or your full card number. The common script is a call or text claiming to be Cash App fraud protection, saying there's an unauthorized charge, and asking you to confirm the code to reverse it. Reading it out hands over the account.

If someone contacts you about the code, end the conversation and reach support through the app itself.

2. Secure the email and phone number the code goes to

Your Cash App account is only as protected as the inbox and phone number attached to it. If someone controls your email, they can request the code and read it. Change that email password, and check the inbox for forwarding rules or filters you didn't create.

3. Set or change your Cash PIN and turn on Security Lock

The PIN is the layer that stands between a signed-in session and your balance. Set one if you haven't, change it if it's a birthday or a repeated digit, and turn on Security Lock so every payment requires the PIN or biometrics rather than just the ones the app decides to challenge.

4. Sign out of sessions you don't recognize

Check the devices signed in to your account and drop anything unfamiliar. Do this after changing the PIN, so a session that's still live can't watch you set the new one.

5. Check the money paths, not just the balance

Look at linked banks and debit cards, recent payments and requests, and your $Cashtag. Attackers who get in often add a card or a bank account first and move money after, so an unfamiliar linked account matters even when the balance looks untouched. Report anything you don't recognize to Cash App and to your bank.

How they got your number

To start this attack, someone needs the phone number or email tied to your Cash App account. Neither is secret.

Data brokers and people-search sites publish current phone numbers and email addresses next to full names and street addresses, assembled from public records and commercial data and sold to anyone who pays. A leaked email from an old breach becomes far more useful once it's matched to a phone number that still works.

That pairing is what makes the call after the code convincing. When someone already knows your name, your city, and the last four digits of a card, "this is Cash App fraud protection" sounds plausible.

Delist finds those listings, files the removals, and re-checks them, since brokers commonly repost a profile within weeks. It doesn't undo an old breach, but it takes down the current contact details that make you reachable. Run a free scan to see where your number is published today.

For the wider pattern behind codes like this, see why you're suddenly getting 2FA codes you didn't request.

Frequently asked questions

Does an unrequested Cash App code mean someone has my password?

Not necessarily. Cash App signs in with a code rather than a password, so all an attacker needs is your phone number or email address to trigger one. The code itself is the thing they're after.

I already gave someone the code. What now?

Change your Cash PIN immediately, sign out of all devices, and check for linked cards or bank accounts you didn't add. Contact Cash App support through the app and tell your bank, particularly if a bank account is linked. Move fast, because transfers are difficult to reverse once they settle.

Can someone take money without my PIN?

The PIN and Security Lock are what stop payments from a signed-in session, which is why setting both matters more than the balance you're currently carrying. Someone with account access but no PIN can still see your history and linked accounts, and may try to add their own card.

Why do I keep getting codes even though nobody gets in?

Someone is repeatedly entering your number on the sign-in screen, either automated or hoping you'll eventually hand over a code to make it stop. Don't. Secure the email on the account and report it to Cash App.

Should I change my $Cashtag?

It can help if yours is being used to target you, since a $Cashtag is public and searchable. It won't fix the underlying issue, which is that your phone number and email are already known.